CN113076235A - Time sequence abnormity detection method based on state fusion - Google Patents

Time sequence abnormity detection method based on state fusion Download PDF

Info

Publication number
CN113076235A
CN113076235A CN202110382900.7A CN202110382900A CN113076235A CN 113076235 A CN113076235 A CN 113076235A CN 202110382900 A CN202110382900 A CN 202110382900A CN 113076235 A CN113076235 A CN 113076235A
Authority
CN
China
Prior art keywords
sequence
time sequence
data
network
time
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN202110382900.7A
Other languages
Chinese (zh)
Other versions
CN113076235B (en
Inventor
梁于宁
吴维刚
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Sun Yat Sen University
Original Assignee
Sun Yat Sen University
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Sun Yat Sen University filed Critical Sun Yat Sen University
Priority to CN202110382900.7A priority Critical patent/CN113076235B/en
Publication of CN113076235A publication Critical patent/CN113076235A/en
Application granted granted Critical
Publication of CN113076235B publication Critical patent/CN113076235B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
    • G06F11/3006—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
    • G06F11/3452—Performance evaluation by statistical analysis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/044—Recurrent networks, e.g. Hopfield networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Mathematical Physics (AREA)
  • Biophysics (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Molecular Biology (AREA)
  • Data Mining & Analysis (AREA)
  • Computational Linguistics (AREA)
  • Biomedical Technology (AREA)
  • Artificial Intelligence (AREA)
  • Software Systems (AREA)
  • Evolutionary Computation (AREA)
  • Quality & Reliability (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Evolutionary Biology (AREA)
  • Probability & Statistics with Applications (AREA)
  • Computer Hardware Design (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

The invention provides a time sequence anomaly detection method based on state fusion, aiming at overcoming the defect that time distortion can cause cluster anomaly detection to have errors due to time sequence characteristics, and comprising the following steps of: collecting time sequence data to be detected and preprocessing the time sequence data to obtain time sequence data XTAnd its corresponding label YT(ii) a The preprocessed time sequence data XTInputting into a semantic analysis network MarkNet to generate a mark sequence ST(ii) a The marker sequence STInputting into MeM module for state fusion analysis to generate marking sequence SU(ii) a The marker sequence SUInputting the data into an anomaly monitoring network DetectNet to carry out anomaly detection to obtain a confidence coefficient P (X), and inputting the confidence coefficient P (X) into the anomaly monitoring network DetectNet to carry out anomaly detectionAnd comparing the confidence coefficient P (X) with a preset comparison threshold epsilon, and outputting a detection result as abnormal when the confidence coefficient P (X) is greater than the preset comparison threshold epsilon, or outputting the detection result as normal.

Description

Time sequence abnormity detection method based on state fusion
Technical Field
The invention relates to the technical field of cluster resource management, in particular to a time sequence abnormity detection method based on state fusion.
Background
Currently, the anomaly detection for the cluster is usually performed from the resource usage of the cluster unit. The resource use condition of the cluster is recorded in a time sequence mode and is output to an analysis module for real-time monitoring or is stored in a large-scale database to be used for subsequent task repeated analysis. Due to the fact that time sequence data have time relevance, the model cannot capture time sequence characteristics due to estimation based on probability distribution, detection accuracy is greatly reduced, and therefore a deep learning model is added in most of work. For example, segment feature extraction is performed on the time sequence through a convolutional neural network, time features of the time sequence are recorded through a cyclic neural network, deep feature induction decomposition is performed through a full-connection network, the neural network has nonlinear features by applying technologies such as maximum pooling and activation functions, and finally a comprehensive judgment score is output by the network. However, the current timing learning method is generally trained and tested time by time, that is, at each time, the network outputs a value to perform the judgment. However, due to the intensive time sequence of data center detection, the time sequence characteristics of the monitored object have time distortion (temporal distortion) due to performance fluctuation, task switching, data center resource fluctuation and the like. For example, due to resource bottlenecks in the data center, peak features existing in a time sequence for recording user access volumes may be elongated, and these features cannot be well mastered by the deep learning model trained frame by frame.
For the time-warping problem of the timing characteristics, the following two techniques are mainly used at present: dynamic Time Warping (DTW) Time sequence similarity measurement technology utilizes Dynamic programming to find the closest distance between two Time sequences, and can solve Time sequence deformation under specific conditions so as to deal with misjudgment caused by Time Warping. However, DTW seeks to calculate the shortest distance between two timings using a priori assumptions, and does not give a reasonable explanation for the phenomenon of timing misalignment. The connected dominant Temporal Classification (CTC) is a sequence transformation method that combines adjacent output values into one for the predicted output of a neural network, thereby obtaining a more simplified time sequence representation. The potential characteristics of the time sequence are distinguished through the time sequence representation, and the subsequent data stream can be transmitted. However, the transformation method of CTC is to combine all the same characteristic states in a sequence, and when a sequence exists for a relatively long time, the representation may be over simplified, and errors may be caused.
Disclosure of Invention
The invention provides a time sequence anomaly detection method based on state fusion, aiming at overcoming the defect that time distortion exists in the time sequence characteristic of the prior art, which causes an error in anomaly detection of a cluster.
In order to solve the technical problems, the technical scheme of the invention is as follows:
a time sequence abnormity detection method based on state fusion comprises the following steps:
s1: collecting time sequence data to be detected and preprocessing the time sequence data to obtain time sequence data XTAnd its corresponding label YT；
S2: the preprocessed time sequence data XTInputting into a semantic analysis network MarkNet to generate a mark sequence ST；
S3: the marker sequence STInputting into MeM module for state fusion analysis to generate marking sequence SU；
S4: the marker sequence SUInputting the data into an anomaly monitoring network DetectNet for anomaly detection to obtain a confidence coefficient P (X), comparing the confidence coefficient P (X) with a preset comparison threshold epsilon, and outputting a detection result as anomaly when the confidence coefficient P (X) is greater than the preset comparison threshold epsilon, or outputting the detection result as normal.
Preferably, the step of preprocessing the time series data to be detected includes denoising and normalizing.
As a preferred scheme, the semantic analysis network MarkNet comprises an LSTM neural network module, a full connection layer structure and a softmax function layer which are sequentially connected.
Preferably, in the step S2, a marker sequence S is generatedTThe method comprises the following specific steps: the preprocessed time sequence data XTInputting the LSTM neural network module of the semantic analysis network MarkNet, and carrying out data processing on input time sequence data X by the LSTM neural network module to obtain a hidden statehtAnd an internal memory state ct(ii) a Wherein the preprocessed time series data XTThe expression formula of (a) is:
XT＝{x1,x2,...,xT},xt∈Rm,t＝1,2,...,T
YT＝{y1,y2,...,yT},yt∈{0,1}
in the formula, xtTime series data X representing inputTThe data at the middle T moment, wherein T is the length of time sequence data; y isTAs time series data XTLabel of (a), ytRepresenting data xtA corresponding label; the calculation formula of the LSTM neural network module is as follows:
(ht,ct)＝flstm(xt-1,ht-1,ct-1)
will hide the state htInputting the input into a full-connection layer structure to generate an n + 1-dimensional output, obtaining a prediction probability distribution through a softmax function layer, and obtaining an output s according to the prediction probability distributiontConstructed marker sequence STThe expression formula is as follows:
st＝fdense(ht)
ST＝{s1,s2,...,sT},s∈L＝{l1,l2,...,ln,φ}
in the formula, L is a marker set, and the L comprises n non-null semantic markers L and 1 null semantic marker phi.
Preferably, the MeM module adopts a link meaning classification method based on window and fusion length limitation to input mark sequence STAnd performing state fusion analysis.
Preferably, in the step S3, a marker sequence S is generatedUComprises the following steps: the marker sequence STInputting the data into a MeM module for state fusion analysis, wherein the MeM module deduplicates adjacent continuous same mark element segments with the length not exceeding w, combines the same mark element segments into a new element segment, and directly removes a blank mark phiObtaining a mark sequence S containing refining information in T timeU(ii) a The expression formula is as follows:
SU＝MeM(ST,w)
in the formula, w represents a parameter for controlling the fusion number by the MeM module.
As a preferred scheme, the calculation formula of the confidence p (x) output by the anomaly monitoring network detectenet is as follows:
P(XT)＝D(SU,XT,ε)
in the formula, D (-) represents a DetectNet neural network model.
Preferably, in the step S4, the anomaly monitoring network detectetnet performs time-series decoding by using an auto-encoder, and inputs the original time-series data into a decoder by using a SkipConnect technique, and outputs the obtained confidence level p (x).
Preferably, the method further comprises the following steps: labeling the confidence level P (X) and the time series data label YTPerforming precision statistics through a Loss function, performing error gradient calculation, and performing reverse gradient propagation and model parameter updating on the semantic analysis network MarkNet and the anomaly monitoring network DetectNet; judging whether the current precision meets a preset precision threshold value or not according to the statistical precision of the Loss function, and finishing training of a semantic analysis network MarkNet if the current precision meets the preset precision threshold value; if not, the step S2 is executed.
As a preferred scheme, the steps of performing inverse gradient propagation and model parameter updating on the semantic analysis network MarkNet and the anomaly monitoring network detectetnet include: judging whether the semantic analysis network MarkNet needs training according to the error gradient obtained by calculation, if so, fixing the parameter theta of the anomaly monitoring network DetectNetDCalculating the detection deviation of the semantic analysis network MarkNet, performing back propagation according to the gradient, updating the parameters of the semantic analysis network MarkNet, and strengthening the semantic understanding capability of the semantic analysis network MarkNet; if not, fixing the parameter theta of the MarkNet of the semantic analysis networkMCalculating the detection deviation of the anomaly monitoring network DetectNet, performing back propagation according to the gradient and carrying out back propagation on the anomaly monitoring networkAnd updating the parameters of the DetectNet, and strengthening the abnormality detection capability of the abnormality monitoring network DetectNet.
Compared with the prior art, the technical scheme of the invention has the beneficial effects that: according to the method, the unknown time sequence data are subjected to semantic calibration by performing calibration marking on the time sequence data to be detected, and the potential semantics of the common time sequence data are analyzed, so that the time sequence mode deformed due to time distortion transformation can be better identified; the time distortion problem of the time sequence is solved by adopting a state fusion method, and the accuracy of the abnormality detection can be effectively improved under the conditions that the computer cluster runs complex tasks and the time sequence fluctuates or distorts.
Drawings
FIG. 1 is a flowchart of a method for detecting a time sequence abnormality based on state fusion according to the present invention.
Fig. 2 is a frame structure diagram of the method for detecting a timing anomaly based on state fusion according to the present invention.
Fig. 3 is a schematic structural diagram of an LSTM neural network module according to an embodiment.
Fig. 4 is a schematic diagram of the time series data to be detected and the tag sequence obtained by inputting the time series data into MarkNet according to the embodiment.
FIG. 5 is a diagram of an embodiment of timing data1 and a mark sequence mark1 thereof.
FIG. 6 is a diagram of an embodiment of timing data2 and its mark sequence mark 2.
FIG. 7 is a diagram of an example marker sequence MeM1 with a state-fused marker sequence mark 1.
FIG. 8 is a diagram of an example marker sequence MeM2 with a state-fused marker sequence mark 2.
Detailed Description
The drawings are for illustrative purposes only and are not to be construed as limiting the patent;
it will be understood by those skilled in the art that certain well-known structures in the drawings and descriptions thereof may be omitted.
The technical solution of the present invention is further described below with reference to the accompanying drawings and examples.
Example (b):
the present embodiment provides a method for detecting a timing anomaly based on state fusion, which is a flowchart and a frame structure diagram of the method for detecting a timing anomaly based on state fusion of the present embodiment, as shown in fig. 1 to 2.
The method for detecting the time sequence abnormality based on the state fusion, provided by the embodiment, comprises the following steps:
s1: collecting time sequence data to be detected and preprocessing the time sequence data to obtain time sequence data XTAnd its corresponding label YT(ii) a The hyper-parameters of the semantic analysis network MarkNet, the MeM module and the anomaly monitoring network DetectNet of the embodiment are set, and model parameters are initialized.
In the step, the step of preprocessing the time sequence data to be detected comprises denoising and normalization processing, and the time sequence data X with the length of T is obtained after the processingTAnd its corresponding label YTThe expression formula is as follows:
XT＝{x1,x2,...,xT},xt∈Rm,t＝1,2,...,T
YT＝{y1,y2,...,yT},yt∈{0,1}
in the formula, xtTime series data X representing inputTData at time t, ytRepresenting data xtA corresponding label.
S2: the preprocessed time sequence data XTInputting into a semantic analysis network MarkNet to generate a mark sequence ST。
The semantic analysis network MarkNet in the embodiment comprises an LSTM neural network module, a full connection layer structure and a softmax function layer which are sequentially connected. Specifically, a marker sequence S is generatedTThe method comprises the following specific steps:
the preprocessed time sequence data XTInputting the LSTM neural network module of the semantic analysis network MarkNet, and performing data processing on input time sequence data X by the LSTM neural network module to obtain a hidden state htAnd an internal memory state ct。
Fig. 3 is a schematic structural diagram of the LSTM neural network module of this embodiment.
The calculation formula of the LSTM neural network module is as follows:
(ht,ct)＝flstm(xt-1,ht-1,ct-1)
as can be seen, the output of the LSTM neural network module at the time t is determined by the input, the hidden state and the memory state at the time t-1.
Will hide the state htInputting the input into a full-connection layer structure to generate an n + 1-dimensional output, obtaining a prediction probability distribution through a softmax function layer, and obtaining an output s according to the prediction probability distributiontConstructed marker sequence STThe expression formula is as follows:
st＝fdense(ht)
ST＝{s1,s2,...,sT},s∈L＝{l1,l2,...,ln,φ}
in the formula, L is a marker set, and the L comprises n non-null semantic markers L and 1 null semantic marker phi.
The semantic analysis network MarkNet in the embodiment adopts an improved LSTM neural network module of the RNN recurrent neural network as a processing unit, has obvious advantages in processing sequence data, and can remember time dependence.
S3: the marker sequence STInputting into MeM module for state fusion analysis to generate marking sequence SU。
In this step, the MeM module uses a link meaning classification method based on window and fusion length restriction to input mark sequence STAnd performing state fusion analysis. Which generates a marker sequence SUComprises the following steps: the marker sequence STInputting into MeM module for state fusion analysis, wherein the MeM module will be adjacent, continuous andthe same mark element segments with the length not exceeding w are deduplicated and combined into a new element segment, and the blank mark phi is directly removed to obtain a mark sequence S containing refining information in the T momentU(ii) a The expression formula is as follows:
SU＝MeM(ST,w)
in the formula, w represents a parameter for controlling the fusion number by the MeM module, and is used for preventing the fusion of overlong time span; the null semantic label phi is used to segment the same element.
In one embodiment, the MeM module pairs the tag sequence STThe results of performing the state fusion analysis are expressed as:
MeM(abbbaaac,3)＝abac
MeM(abbbab,2)＝abbab
MeM(abbaφa,2)＝abaa
the principle of the MeM module in this embodiment can be analogized to the problem of speech recognition, and the same text can correspond to speech data of different lengths. In a data center, task execution times may not be consistent, and to train a frame-by-frame, time-by-time model, data needs to be aligned more strictly. This is difficult to handle in data centers with varying task execution times and large resource fluctuations. Therefore, the MeM module utilizes the prediction state of the combined adjacent time, a new mark sequence containing refining information in the T moment can be obtained in the allowable time span w, and the new mark sequence is a more universal mode, thereby being beneficial to subsequent anomaly detection.
S4: the marker sequence SUInputting the data into an anomaly monitoring network DetectNet for anomaly detection to obtain a confidence coefficient P (X), comparing the confidence coefficient P (X) with a preset comparison threshold epsilon, and outputting a detection result as anomaly when the confidence coefficient P (X) is greater than the preset comparison threshold epsilon, or outputting the detection result as normal.
In this step, the calculation formula of the confidence p (x) output by the anomaly monitoring network detectenet is as follows:
P(XT)＝D(SU,XT,ε)
in the formula, D (-) represents a DetectNet neural network model.
The anomaly monitoring network DetectNet in this embodiment serves as a decoder, reconstructs a time sequence according to the marker sequence, and compares the time sequence with an original time sequence, so that time influence can be robustly eliminated, and an anomaly judgment confidence value p (x) is made. In this embodiment, the anomaly monitoring network DetectNet performs time-series decoding by using an auto-encoder, and simultaneously inputs the original time-series data into a decoder by using a Skip Connect technique, and outputs a confidence p (x).
Further, the confidence P (X) and the time sequence data label YTPerforming precision statistics through a Loss function, performing error gradient calculation, and performing reverse gradient propagation and model parameter updating on the semantic analysis network MarkNet and the anomaly monitoring network DetectNet; judging whether the current precision meets a preset precision threshold value or not according to the statistical precision of the Loss function, and finishing training of a semantic analysis network MarkNet if the current precision meets the preset precision threshold value; if not, the step S2 is executed.
The steps of carrying out reverse gradient propagation and model parameter updating on the semantic analysis network MarkNet and the anomaly monitoring network DetectNet comprise:
(1) parameter theta of fixed anomaly monitoring network DetectNetDCalculating the detection deviation of the semantic analysis network MarkNet, performing back propagation according to the gradient, updating the parameters of the semantic analysis network MarkNet, and strengthening the semantic understanding capability of the semantic analysis network MarkNet;
(2) parameter theta of fixed semantic analysis network MarkNetMAnd calculating the detection deviation of the anomaly monitoring network DetectNet, performing back propagation according to the gradient, updating the parameters of the anomaly monitoring network DetectNet, and strengthening the anomaly detection capability of the anomaly monitoring network DetectNet.
The steps can be analogized to generate a training process of the countermeasure network, whether the semantic analysis network MarkNet needs to be trained is judged according to the error gradient obtained by calculation, if yes, the step (1) is executed, otherwise, the step (2) is executed, then reverse gradient propagation and model parameter updating are carried out, whether the current precision meets a preset precision threshold is further judged according to the precision of the Loss function statistics, and if yes, the training of the semantic analysis network MarkNet is finished; if not, the step S2 is executed.
In one embodiment, the Pytorch deep learning framework, Python programming language, or other similar language is used for encoding and implementation. In the implementation process, after time series data of several data center clusters are preprocessed, training data sets are generated by random sampling, and the method disclosed by the invention is applied to the data to carry out anomaly detection. Compared with a pure network model, such as an LSTM model and a VAE detection model, the double-layer model + MeM state fusion module can effectively detect the mode after deformation.
Example verification results prove that the method provided by the invention can ensure the robustness of the detection method under the condition of time distortion.
Fig. 4 is a schematic diagram of the time series data to be detected and the mark sequence obtained by inputting the time series data into MarkNet. In the decomposition point at the time when t is 200, the frequency of the time sequence changes, that is, the time sequence data to be detected is composed of two time sequence data with different frequencies, as shown in fig. 5 and 6, the time sequence data with two different frequencies and the mark sequence diagram obtained by inputting the time sequence data into MarkNet are respectively shown, wherein the mark sequences made for the time sequence data1 with the first frequency and the time sequence data2 with the second frequency are shown as mark1 and mark2 curves. Through the state fusion window of the MeM block with w set to 200, the tag sequences of the time series data of both frequencies become the same shape, as shown in fig. 7 and 8. By setting the appropriate state fusion window, the sequences MeM1, MeM2 through the state fusion process both have the same shape representation. Finally, the marker sequences of the time sequences with two different frequencies are changed into the same representation form, and the marker sequences are used as a characteristic sequence of the time sequences to carry out subsequent abnormity detection and judgment so as to obtain a judgment result with higher accuracy.
In this embodiment, on the one hand, a method for labeling timing data is provided, which is used for labeling a semantic meaning for an unknown timing data and is used in a subsequent timing processing process. On the other hand, an improved time sequence state fusion analysis mechanism is provided, potential semantics of a time sequence are analyzed, and a time sequence mode deformed due to time warping transformation can be better identified and used for judging the state of the computer cluster. The latent semantics of the time sequence can be analyzed aiming at the common time sequence, and the latent operation rule of the time sequence can be analyzed under the condition that the task running behind the time sequence is unknown. After the semantic mark is given, the method can still robustly identify the time sequence when the time sequence has distortion and the potential time sequence mode is scaled. The model is applied to cluster machines for task detection, so that abnormal mode identification under the conditions of variable data center tasks and frequent resource switching can be better responded, operation managers are helped to effectively identify the health state of a computing unit, the running state of a detection task and the use state of resources, the utilization efficiency of the resources is improved, and more benefits are created. In addition, in the model training process, the embodiment generates the confrontation network by analogy, and the accuracy of time sequence analysis can be better improved by training the two modules mutually.
It should be understood that the above-described embodiments of the present invention are merely examples for clearly illustrating the present invention, and are not intended to limit the embodiments of the present invention. Other variations and modifications will be apparent to persons skilled in the art in light of the above description. And are neither required nor exhaustive of all embodiments. Any modification, equivalent replacement, and improvement made within the spirit and principle of the present invention should be included in the protection scope of the claims of the present invention.

Claims (10)

1. A time sequence abnormity detection method based on state fusion is characterized by comprising the following steps:
s1: collecting time sequence data to be detected and preprocessing the time sequence data to obtain time sequence data XTAnd its corresponding label YT；
S2: the preprocessed time sequence data XTInputting into a semantic analysis network MarkNet to generate a mark sequence ST；
S3: the marker sequence STInputting into MeM module for state fusion analysis to generate marking sequence SU；
S4: the marker sequence SUInputting the data into an anomaly monitoring network DetectNet for anomaly detection to obtain a confidence coefficient P (X), comparing the confidence coefficient P (X) with a preset comparison threshold epsilon, and outputting a detection result as anomaly when the confidence coefficient P (X) is greater than the preset comparison threshold epsilon, or outputting the detection result as normal.
2. The method for detecting time sequence abnormity based on state fusion of claim 1, wherein the step of preprocessing the time sequence data to be detected comprises denoising and normalization processing.
3. The method for detecting the time sequence abnormality based on the state fusion is characterized in that the semantic analysis network MarkNet comprises an LSTM neural network module, a full connection layer structure and a softmax function layer which are connected in sequence.
4. The method according to claim 3, wherein in the step S2, a marker sequence S is generatedTThe method comprises the following specific steps:
the preprocessed time sequence data XTInputting the LSTM neural network module of the semantic analysis network MarkNet, and performing data processing on input time sequence data X by the LSTM neural network module to obtain a hidden state htAnd an internal memory state ct(ii) a Wherein the preprocessed time series data XTThe expression formula of (a) is:
XT＝{x1,x2,...,xT},xt∈Rm,t＝1,2,...,T
YT＝{y1,y2,...,yT},yt∈{0,1}
in the formula, xtTime series data X representing inputTThe data at the middle T moment, wherein T is the length of time sequence data; y isTAs time series data XTLabel of (a), ytRepresenting data xtA corresponding label; calculation formula of LSTM neural network moduleThe following were used:
(ht,ct)＝flstm(xt-1,ht-1,ct-1)
will hide the state htInputting the input into a full-connection layer structure to generate an n + 1-dimensional output, obtaining a prediction probability distribution through a softmax function layer, and obtaining an output s according to the prediction probability distributiontConstructed marker sequence STThe expression formula is as follows:
st＝fdense(ht)
ST＝{s1,s2,...,sT},s∈L＝{l1,l2,...,ln,φ}
in the formula, L is a marker set, and the L comprises n non-null semantic markers L and 1 null semantic marker phi.
5. The method according to claim 4, wherein the MeM module uses a link-sense classification method based on window and fusion length restriction on the input tag sequence STAnd performing state fusion analysis.
6. The method for detecting time series abnormality based on state fusion according to claim 5, wherein in the step of S3, a marker sequence S is generatedUComprises the following steps: the marker sequence STInputting the mark sequence S into a MeM module for state fusion analysis, wherein the MeM module deduplicates adjacent continuous same mark element segments with the length not exceeding w, combines the mark element segments into a new element segment, and directly removes a blank mark phi to obtain a mark sequence S containing refining information within the time TU(ii) a The expression formula is as follows:
SU＝MeM(ST,w)
in the formula, w represents a parameter for controlling the fusion number by the MeM module.
7. The method for detecting the time sequence abnormality based on the state fusion of claim 6, wherein the confidence P (X) output by the abnormality monitoring network DetectNet is calculated according to the following formula:
P(XT)＝D(SU,XT,ε)
in the formula, D (-) represents a DetectNet neural network model.
8. The method according to claim 7, wherein in the step S4, the anomaly monitoring network detectetnet performs time-series decoding by using an auto-encoder, and inputs the original time-series data into a decoder by using a SkipConnect technique, and outputs a confidence p (x).
9. The method for detecting the time sequence abnormity based on the state fusion according to any one of claims 1 to 8, characterized by further comprising the following steps: labeling the confidence level P (X) and the time series data label YTPerforming precision statistics through a Loss function, performing error gradient calculation, and performing reverse gradient propagation and model parameter updating on the semantic analysis network MarkNet and the anomaly monitoring network DetectNet; judging whether the current precision meets a preset precision threshold value or not according to the statistical precision of the Loss function, and finishing training of a semantic analysis network MarkNet if the current precision meets the preset precision threshold value; if not, the step S2 is executed.
10. The method for detecting the time sequence abnormality based on the state fusion of claim 9, wherein the steps of performing inverse gradient propagation and model parameter updating on the semantic analysis network MarkNet and the abnormality monitoring network detectetnet include: judging whether the semantic analysis network MarkNet needs training according to the error gradient obtained by calculation, if so, fixing the parameter theta of the anomaly monitoring network DetectNetDCalculating the detection deviation of the semantic analysis network MarkNet, performing back propagation according to the gradient, updating the parameters of the semantic analysis network MarkNet, and strengthening the semantic understanding capability of the semantic analysis network MarkNet; if not, fixing the parameter theta of the MarkNet of the semantic analysis networkMAnd calculating the detection of the abnormal monitoring network DetectNetAnd measuring deviation, performing back propagation according to the gradient, updating parameters of the anomaly monitoring network DetectNet, and strengthening the anomaly detection capability of the anomaly monitoring network DetectNet.
CN202110382900.7A 2021-04-09 2021-04-09 Time sequence abnormity detection method based on state fusion Active CN113076235B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202110382900.7A CN113076235B (en) 2021-04-09 2021-04-09 Time sequence abnormity detection method based on state fusion

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202110382900.7A CN113076235B (en) 2021-04-09 2021-04-09 Time sequence abnormity detection method based on state fusion

Publications (2)

Publication Number Publication Date
CN113076235A true CN113076235A (en) 2021-07-06
CN113076235B CN113076235B (en) 2022-10-18

Family

ID=76615772

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202110382900.7A Active CN113076235B (en) 2021-04-09 2021-04-09 Time sequence abnormity detection method based on state fusion

Country Status (1)

Country Link
CN (1) CN113076235B (en)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113554077A (en) * 2021-07-13 2021-10-26 南京铉盈网络科技有限公司 Working condition evaluation and traffic prediction method based on multi-mode neural network model
CN115795401A (en) * 2023-02-08 2023-03-14 青岛海洋地质研究所 Ocean pasture full-factor monitoring sensor multi-data fusion system

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110154119A1 (en) * 2009-12-23 2011-06-23 Jia Wang Device and Method for Detecting and Diagnosing Correlated Network Anomalies
CN104021084A (en) * 2014-06-19 2014-09-03 国家电网公司 Method and device for detecting defects of Java source codes
US20150127983A1 (en) * 2010-12-23 2015-05-07 Intel Corporation Test, validation, and debug architecture
CN105653427A (en) * 2016-03-04 2016-06-08 上海交通大学 Log monitoring method based on abnormal behavior detection
WO2019060327A1 (en) * 2017-09-20 2019-03-28 University Of Utah Research Foundation Online detection of anomalies within a log using machine learning
WO2019215478A1 (en) * 2018-05-08 2019-11-14 Abc Software, Sia A system and a method for sequential anomaly revealing in a computer network
US20210027167A1 (en) * 2019-07-26 2021-01-28 Cisco Technology, Inc. Model structure extraction for analyzing unstructured text data
CN112541180A (en) * 2020-12-16 2021-03-23 北京理工大学 Software security vulnerability detection method based on grammatical features and semantic features

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110154119A1 (en) * 2009-12-23 2011-06-23 Jia Wang Device and Method for Detecting and Diagnosing Correlated Network Anomalies
US20150127983A1 (en) * 2010-12-23 2015-05-07 Intel Corporation Test, validation, and debug architecture
CN104021084A (en) * 2014-06-19 2014-09-03 国家电网公司 Method and device for detecting defects of Java source codes
CN105653427A (en) * 2016-03-04 2016-06-08 上海交通大学 Log monitoring method based on abnormal behavior detection
WO2019060327A1 (en) * 2017-09-20 2019-03-28 University Of Utah Research Foundation Online detection of anomalies within a log using machine learning
WO2019215478A1 (en) * 2018-05-08 2019-11-14 Abc Software, Sia A system and a method for sequential anomaly revealing in a computer network
US20210027167A1 (en) * 2019-07-26 2021-01-28 Cisco Technology, Inc. Model structure extraction for analyzing unstructured text data
CN112541180A (en) * 2020-12-16 2021-03-23 北京理工大学 Software security vulnerability detection method based on grammatical features and semantic features

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113554077A (en) * 2021-07-13 2021-10-26 南京铉盈网络科技有限公司 Working condition evaluation and traffic prediction method based on multi-mode neural network model
CN115795401A (en) * 2023-02-08 2023-03-14 青岛海洋地质研究所 Ocean pasture full-factor monitoring sensor multi-data fusion system
CN115795401B (en) * 2023-02-08 2023-04-21 青岛海洋地质研究所 Multi-data fusion system of marine pasture full-element monitoring sensor

Also Published As

Publication number Publication date
CN113076235B (en) 2022-10-18

Similar Documents

Publication Publication Date Title
CN112784965B (en) Large-scale multi-element time series data anomaly detection method oriented to cloud environment
CN109034368A (en) A kind of complex device Multiple Fault Diagnosis Method based on DNN
CN113076235B (en) Time sequence abnormity detection method based on state fusion
KR20210141784A (en) A method for training a deep learning network based on AI and a learning device using the same
CN116304820B (en) Bearing fault type prediction method and system based on multi-source domain transfer learning
CN116204770B (en) Training method and device for detecting abnormality of bridge health monitoring data
Gu et al. An improved sensor fault diagnosis scheme based on TA-LSSVM and ECOC-SVM
Jia et al. Spatio-temporal autoencoder for feature learning in patient data with missing observations
CN115994630B (en) Multi-scale self-attention-based equipment residual service life prediction method and system
CN115617614A (en) Log sequence anomaly detection method based on time interval perception self-attention mechanism
CN113553245B (en) Log anomaly detection method combining bidirectional slice GRU and gate control attention mechanism
Wu et al. Quality estimation method for gear hobbing based on attention and adversarial transfer learning
Fu et al. MCA-DTCN: A novel dual-task temporal convolutional network with multi-channel attention for first prediction time detection and remaining useful life prediction
CN109324595B (en) Industrial monitoring data classification method based on incremental PCA
CN114416479A (en) Log sequence anomaly detection method based on out-of-stream regularization
Piano et al. Detecting drift in deep learning: A methodology primer
CN115511012B (en) Class soft label identification training method with maximum entropy constraint
CN116362247A (en) Entity extraction method based on MRC framework
Zhu et al. Profile Abstract: An Optimization-based Subset Selection and Summarization Method for Profile Data Mining
CN114896402A (en) Text relation extraction method, device, equipment and computer storage medium
CN115062402A (en) Data-driven train level acceleration extraction method
Cao et al. Anomaly detection for screw tightening timing data with LSTM recurrent neural network
Chen et al. A two-stage adversarial transformer based approach for multivariate industrial time series anomaly detection
Cao et al. Soft Sensor Change Point Detection and Root Causal Analysis
Wei Study on behaviour anomaly detection method of English online learning based on feature extraction

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant